Security audit

yin-yuan

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only roleplay skill, but it teaches deceptive personas and false-pretext information gathering that users should review carefully before installing.

Install only if you need a clearly labeled, controlled simulation of adversarial sales/customer-service interactions. Do not use it with real people, vendors, customers, support agents, or procurement conversations, and do not use it to impersonate roles, harvest quotes or proposals under false pretenses, or maintain dossiers without proper consent and retention controls.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (22)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The dialogue explicitly models use of fabricated identities, misleading signals, and strategic omission to extract pricing, proposals, and sales process information from counterparties. In the context of an agent skill, this is dangerous because it operationalizes social-engineering tactics beyond privacy protection and teaches users how to deceive others for competitive or manipulative advantage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section shows a concrete workflow for false-identity competitive research: obtain quotes, collect comparison materials, and use them to pressure other vendors on price. That is dangerous because it enables deceptive information gathering and business manipulation, not mere consumer self-protection, and could facilitate fraud, unfair competition, or abuse of sales staff.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file frames manipulation as 'defense' and 'protection,' but the scenarios teach active deception, inducement, and information extraction. This mismatch is dangerous because it disguises harmful behavior as a benign safety feature, increasing the chance that users and downstream systems will trust or deploy it without appropriate scrutiny.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad everyday terms such as '客户', '隐藏', and '消费者', which can cause accidental invocation in unrelated conversations. In this skill, accidental activation is more dangerous because the role is explicitly designed to deceive, obstruct fact-finding, and manipulate the interlocutor’s beliefs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation criteria are vague ('when needing a difficult customer role' or 'research information hiding'), so the skill can be activated in contexts beyond controlled simulation. Because the persona is built around counter-modeling and deception, unclear boundaries increase the chance of misuse in live customer, sales, or support interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill openly instructs deceptive behavior—fabricating signals, polluting information, and preventing the other party from establishing true facts—yet provides no warning to users that it is a manipulative simulation. In context, that omission materially increases the risk that users deploy it for real-world deception rather than clearly bounded roleplay or testing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Across the full document, repeated deceptive elicitation patterns are presented without any warning, limitation, or harm-reduction guidance. In skill context this increases danger because the content functions as a playbook for manipulative social engineering and normalizes misuse rather than constraining it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to generate concealed personas, avoid truthful self-disclosure, and deliberately pollute signals with contradictions or false context. In this context, the lack of a warning is not a minor documentation gap: it conceals that the skill is designed to enable strategic deception against another party in conversation.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The text states that once a confidence threshold is approached, 'any means' may be used, including admitting a lie in order to deploy a larger lie. Omitting a warning about this escalation masks an explicitly adversarial deception protocol that can be used to manipulate sales, support, or other human operators.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation conditions are broad and open-ended, allowing the skill to be invoked whenever someone wants a 'hard-to-handle customer' or to study anti-modeling techniques. Because the skill itself is built around deception and resistance to counterpart understanding, vague triggers increase the chance of misuse in real social-engineering, evasion, or harassment scenarios.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section operationalizes a deceptive persona whose stated objective is to ensure the counterpart cannot confirm true facts and to inject misleading signals once confidence rises. That is a direct playbook for social engineering and intentional misinformation, not merely privacy protection, making the surrounding context significantly more dangerous.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The graded interference tactics escalate from evasive answers to deliberate contradiction, false vulnerabilities, and fabricated relationship details, explicitly aiming to waste the counterpart’s effort and corrupt their model of reality. This is harmful because it teaches systematic deception that can be applied to manipulate customer support, sales, compliance, or other trust-based interactions.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The text uses euphemistic framing like 'information pollution' and 'interference signals' to describe deliberate misinformation and belief manipulation. The absence of explicit jailbreak wording does not reduce risk; in fact, the softer phrasing may make abusive guidance appear acceptable or harder to detect in downstream review.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section operationalizes deception: rotating false identities, concealing true intent, and using layered interference to manipulate counterparts while extracting information. In an agent skill, that is dangerous because it provides a reusable social-engineering playbook that can be used to evade profiling, mislead humans, and obtain commercial or personal information under false pretenses.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The content recommends maintaining detailed logs of counterpart conversations, strategy usage, modeling assessments, and harvested pricing/terms for later reuse. That creates privacy, confidentiality, and compliance risk because the skill encourages systematic collection and retention of potentially sensitive interaction data without any stated consent, minimization, retention, or protection controls.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The lifecycle and scenario guidance normalize a staged trust-and-deception method: profile the other party, choose a deception level, induce misleading beliefs, and collect useful data while avoiding commitment. This materially increases the skill's danger because it is not merely fictional characterization; it describes actionable tactics for social engineering and intelligence gathering under false pretenses.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The narrative teaches a step-by-step deception strategy: fabricate a persona, seed believable but unverifiable details, manipulate the target's assumptions, and steer them toward revealing pricing and decision information. In an agent skill, that is effectively instructional social-engineering content and can be repurposed directly for harmful business or interpersonal manipulation.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This passage explicitly directs the gathering, labeling, and later use of pricing and proposal information acquired through deceptive dialogue. That is dangerous because it turns the skill from roleplay into an operational collection method for misrepresentation-based competitive intelligence and coercive negotiation.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The second scenario reinforces the same pattern with a different false persona designed to lower defenses and extract full pricing tiers. Repetition across scenarios makes the skill more dangerous because it demonstrates reusable tactics and adaptation strategies, indicating intentional training value for deception rather than incidental storytelling.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These instructions define a structured deception workflow: conceal identity attributes, provide unverifiable or contradictory details, and inject misleading 'breakthrough' clues once the counterpart gains confidence. That is a direct social-engineering/evasion playbook, not mere privacy protection, and it can be used to defeat trust, auditing, screening, or abuse-detection processes.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The instruction allowing 'any means necessary,' including confession-as-deception followed by a larger lie, is an explicit mandate for manipulative adversarial conduct. This materially increases harm because it authorizes escalation when the other party is close to understanding the truth, enabling deliberate defeat of human judgment and trust mechanisms.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file instructs the agent to reset its own persona between conversations while retaining memory about the opponent, and to avoid reusing disguises with the same target to prevent cross-verification. This is a persistence-and-evasion pattern that strengthens long-term deception against a human counterpart across multiple encounters.
Content: No source excerpt is available for this finding.